Описание
SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMISSIONS clauses execute with enforcement disabled. Attackers with permission to perform a guarded operation can write to tables they lack permission for by embedding CREATE, UPDATE, DELETE, or UPSERT statements in the PERMISSIONS clause, causing unintended writes and data corruption.
Ссылки
- Vendor AdvisoryMitigation
- Third Party Advisory
Уязвимые конфигурации
EPSS
4.3 Medium
CVSS3
6.5 Medium
CVSS3
Дефекты
Связанные уязвимости
SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMISSIONS clauses execute with enforcement disabled. Attackers with permission to perform a guarded operation can write to tables they lack permission for by embedding CREATE, UPDATE, DELETE, or UPSERT statements in the PERMISSIONS clause, causing unintended writes and data corruption.
EPSS
4.3 Medium
CVSS3
6.5 Medium
CVSS3